Am I feeding you? Ask without an account
An ADS-B receiver can feed a network in two very different ways, and from the outside they look identical.
The first way: the stream carries a station id — a uuid you generated when you registered a receiver on /feed. Everything we know how to do with your data hangs off that id. Your station gets a page, a name you choose, a permanent number, daily statistics, the rarest aircraft it heard, the 📡 badge on your profile.
The second way: the stream carries nothing. It arrives, it is decoded, the aircraft in it show up on the map and in the game exactly like anyone else's. And it is credited to nobody. Not to a page, not to a badge, not to a year of uptime — nobody, because there is nothing in the bytes to credit it to.
We could see those receivers all along. Our ingest lists every connected client, and the ones without an id sat in that list being useful and invisible. The problem was that we had no way to speak to them: they have no account to log into and no key to paste, so every surface we own was addressed to somebody else.
The button
/feed now has one: Check my address. It compares the address your browser is asking from with the addresses our ingest currently sees, and answers with one of a small number of honest sentences.
Yes, and it is your registered station — with its live message rate and how long the connection has been up. Yes, and it carries a station id that belongs to someone (we do not say who: that id is what proves who caught which aircraft, and handing it to a stranger who happens to share a network would let them feed as that station). Yes, but anonymously — here is exactly what you are missing and the two steps to claim it. Connected but silent, which is the classic "the dongle fell out": the socket is up, the decoder is dead.
And two answers that are deliberately not "no". Nothing is arriving from this address comes with the reminder that if you are asking from your phone or from work, the answer says nothing at all about your receiver. We couldn't check is its own state, separate from "no", because the comparison legitimately fails for people whose hardware is perfectly fine — most often when the browser is on IPv6 while the Raspberry Pi is on IPv4. Telling somebody their working receiver is dead sends them up a ladder in the rain, and we would rather say we don't know.
Your address is compared in memory and stored nowhere. Nothing is linked automatically either: matching addresses is not proof of ownership — plenty of people share one — so claiming a stream still means registering a receiver and putting its uuid in your feeder config.
The leak we found on the way in
Building this meant reading the ingest's list of connected clients, which is how we noticed that the same file was reachable from the public internet. Every row in it carries a feeder's public IP address and their station uuid — and that uuid is the attribution key. Anybody who read the file could have fed as somebody else's station and taken credit for its catches.
It is closed now, at the edge, the same way the per-receiver query API was closed for a related reason: knowing which aircraft one receiver heard locates its antenna to within a few kilometres. Our own backend reads both from inside the private network, where they belong. Nothing about the public map changes — it never used that file.
If you have been feeding us anonymously, the page will now tell you so, and claiming your history takes about two minutes. If you have not been feeding us at all, the connector line is on the same page — one line, non-exclusive, and every other network you send to keeps working exactly as it does today.